SuperTokens Core up to 12.3.0 SAML Audience Validation validateSamlResponseAudience assertion

Summaryinfo

A vulnerability was found in SuperTokens Core up to 12.3.0 and classified as critical. The impacted element is the function validateSamlResponseAudience of the component SAML Audience Validation. Such manipulation leads to assertion. This vulnerability is referenced as CVE-2026-123802. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in SuperTokens Core up to 12.3.0 and classified as critical. Affected by this issue is the function validateSamlResponseAudience of the component SAML Audience Validation. The manipulation with an unknown input leads to a assertion vulnerability. Using CWE to declare the problem leads to CWE-617. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. Impacted is confidentiality, integrity, and availability. CVE summarizes:

SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did not satisfy the audience check. When the identity provider uses assertion-level signing, an attacker who has a still-valid IdP-signed assertion naming the victim for any audience and the attacker's own valid assertion for the target audience can combine them because validateSamlResponseAudience accepts an audience from one assertion while extractAllClaims takes the final NameID and attributes from another; response-level signing does not expose this multi-assertion variant. Independently, an assertion from an identity provider configured for the target deployment but issued to another SuperTokens deployment using the shared default saml_sp_entity_id can satisfy the target's audience check. Successful exploitation authenticates the attacker as the victim IdP user. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-123802 since 11/06/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available.

Upgrading to version 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1 or 12.3.1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• SuperTokens

Name

• Core

Version

• 11.3.0
• 11.3.1
• 11.3.2
• 11.3.3
• 11.3.4
• 11.3.5
• 11.3.6
• 11.3.7
• 11.4.0
• 11.4.1
• 11.4.2
• 11.4.3
• 11.4.4
• 11.4.5
• 11.4.6
• 11.4.7
• 12.0
• 12.0.0
• 12.0.1
• 12.0.2
• 12.0.3
• 12.0.4
• 12.0.5
• 12.0.6
• 12.0.7
• 12.0.8
• 12.0.9
• 12.0.10
• 12.1
• 12.1.0
• 12.1.1
• 12.2
• 12.2.0
• 12.3.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion